Making wheel group membership sufficient for su on SLES 2015

Question

I'm using SLES 2015. I want to make membership in the wheel group sufficient for root-privilege access via su.

From Debian distributions, I'm used to uncommenting the command:

auth       sufficient pam_wheel.so trust

in /etc/pam.d/su. But - this doesn't exist in SLES' /etc/pam.d/su file. I entered it manually, after the other auth commands, but - it doesn't work. Also did the same in /etc/pam.d/su-l for good measure, but no help.

What should I do to avoid the password check?

Notes:

• I'm not interested in sudo in this respect.
• I have root access to the machine, obviously.

Answer 1

I entered it manually, after the other auth commands, but - it doesn't work.

The order of the items in the stack is important as PAM proceeds through them in sequence.

Citing (from man pam.conf) the relevant explanation for what the sufficient control flag does:

if such a module succeeds and no prior required module has failed the PAM framework returns success to the application or to the superior PAM stack immediately without calling any further modules in the stack. A failure of a sufficient module is ignored and processing of the PAM module stack continues unaffected.

So the order of the auth items in /etc/pam.d/su should probably be:

auth        sufficient  pam_rootok.so
auth        sufficient  pam_wheel.so trust
auth        required    pam_unix.so

Or else you will be asked for a password (via the pam_unix line or possible other entries).